Installing the cryptography Library

Python's cryptography package is the reference implementation of modern cryptographic primitives: it wraps OpenSSL's battle-tested C code behind a Python API and is a dependency of Django, Flask, and most security tooling. Installation is a single pip command; this chapter also verifies that the OpenSSL backend is healthy and shows the minimal import patterns you will use throughout the tutorial.

Install

pip install cryptography

# check what got installed
python -m pip show cryptography

On Linux the package may use your system's OpenSSL or a bundled one; on Windows and macOS pip wheels ship everything needed. If you build from source, a C compiler and OpenSSL headers are required.

Verify the Backend

from cryptography import __version__, __osx_ssl_version__, __libssl_version__

print("cryptography", __version__)
print("OpenSSL", __libssl_version__)   # e.g. OpenSSL 3.0.x

Run a smoke test that exercises the core primitives - a hash, a Fernet round-trip, and an RSA keypair:

import hashlib
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives.asymmetric import rsa

print(hashlib.sha256(b"ok").hexdigest()[:16])

token = Fernet(Fernet.generate_key()).encrypt(b"hello")
print("fernet ok:", len(token) > 0)

key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
print("rsa ok:", key.key_size, "bits")

Anything failing here means the installation or the OpenSSL backend is broken; fix that before writing application code.

The OpenSSL CLI

Many servers and scripts still shell out to OpenSSL for certificates and key operations. The same machine typically has the CLI alongside the library:

openssl version
# self-signed certificate for local testing
openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 30 -nodes -subj "/CN=localhost"

The X.509 chapter uses both: openssl for generating test certificates and cryptography for reading and verifying them in Python.

Pinning and Requirements

List cryptography in your requirements file with a version range you have tested. Security releases fix vulnerabilities, so keep it updated, but upgrade deliberately - the API is stable, yet occasionally a deprecated primitive is removed in a major release.

Summary

Install with pip, confirm the version and OpenSSL backend with a small smoke test, keep the OpenSSL CLI handy for certificates, and pin the dependency in your project so security updates are a controlled upgrade rather than a surprise.